Bug 1007186 (CVE-2013-4331)

Summary:	CVE-2013-4331 lightdm: Word-readable .Xauthority
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	christoph.wickert, gregor, rdieter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-22 15:27:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1007187
Bug Blocks:	1007189

Description Ratul Gupta 2013-09-12 05:21:33 UTC

It was found that lightdm prior to versions 1.4.3 and 1.6.2 created .Xauthority files in a user's home directory with world-readable permissions.  If a local user was able to access this file of another user, they could obtain the magic cookie it contained and connect to the X server as that user.  This would only be possible if the user's home directory did not have appropriate secure permissions (such as 0700).

Links to fixing commits:

1.4.x:
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1571
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1576
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1577

1.6.x:
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1641
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1652
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1653

Bug Reports:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721744

Comment 1 Ratul Gupta 2013-09-12 05:26:54 UTC

Created lightdm tracking bugs for this issue:

Affects: fedora-all [bug 1007187]

Comment 2 Ratul Gupta 2013-09-12 06:06:18 UTC

This was assigned CVE-2013-4331: http://www.openwall.com/lists/oss-security/2013/09/11/8